Random denying of access to folders

[jjohnsoncantell]

Greetings,

 

Im having a recurring problem with what seems to be user account control being re-enabled after being disabled. Before i reimaged all our clients over the holiday we used to get random machines denying access to system folders when full admins were logged in. We used to have permission requests when running programs on those machines when they had worked fine in the past. When i reimaged everything this summer the problem disappeared until the last week or so when it has started up again. Im currently logged in with my setup account as normal which is an account with domain admin rights and is a forced mandatory profile. I am being denied access to the temp folder and denied access to deleting files out of the system32 directory unless i take control of them. This user account works perfectly ok on other clients and i dont get these problems. All the clients were reimaged barely a month ago and have been working perfectly fine until now.

 

I really dont know where to start to fix this problem. Any suggestions?

Thanks

James

[jjohnsoncantell]

anyone got any idea?

[DrPerceptron]

Have you tried running gpresult /H on both machines and comparing the results to see if they are doing something weird with a group policy somewhere along the line?

 

Likewise, what happens if you move a "broken" machine to the same OU as the other machines? Or are they actually physically in the same room?

[jjohnsoncantell]

Ive compared a report on both but apart from a few explainable differences theyre the same. I just dont get why some machines would act differently when they are all from the same image.

[jjohnsoncantell]

anyone able to shed some light on this problem?

[jjohnsoncantell]

looks like it was an option related to user account control that was still enabled for some reason. There are no gpo's that would have enabled this, nor was it enabled in the image. Got a screenshot of the policy in question below. Any idea how this would have been reenabled on some clients and not others?